Services
Services is where a domain gets its capabilities. Select one of your DNS zones, and the page lists the domains in it with the services attached to each.
Every zone arrives ready to use, with:
- a Website and a Mail service on the zone's own domain
- a Website Alias on
www.<domain>, pointing at that site - a Mail Server on
mail.<domain> - an Identity Provider on
accounts.<domain>
So the common cases need nothing new here: you can put content on your site and create domain users immediately.
You create a service to go beyond that starter set, usually on a subdomain,
e.g. a site on shop.<domain> or mail on team.<domain>. Adding anything
new is always creating a service on a domain; the domain itself is
created with it if it doesn't exist yet.
Domains, zones, and services explains the model.
Your hosting provider provisions your zones. You can't add or delete a zone here; you build inside the ones your account has.
Service types
| Type | What it does |
|---|---|
| Website | Hosts a website on a domain. Type the name relative to the zone: www, shop, or @ for the zone's own domain. The site then exists, with DNS pointing at the server and automatic HTTPS. |
| Website Alias | Makes another domain serve an existing website, e.g. www.example.com as an alias of example.com, which the panel creates for you. An alias shares its target's files and settings. |
| Lets the domain send and receive mail. The panel generates the MX, SPF, DKIM, and DMARC records, and you can then create domain accounts. | |
| Mail Server | The access side of email: webmail and client connections. Each Mail service names the Mail Server its users connect through. Most zones have one. |
| Identity Provider | An OpenID Connect provider on your domain: the sign-in portal of your domain users, and their single sign-on into apps. Each website names the identity provider it authenticates against. |
Website settings
A website has three settings on its General tab.
Document Root
The folder the site serves to visitors, relative to your home directory,
default public/<domain>; you can point it anywhere inside your home
directory. Set as Web Root in the
file manager does the same from the other end.
The web server also needs read permission on the files.
Mounts add app servers, forwarded ports, and extra directories to a site. See Mounts.
Wildcard subdomains
Wildcard subdomains makes the site also serve every subdomain of its
own name: example.com with this on also answers for shop.example.com
and the other names under it, with the same files, settings, and sign-in.
When you turn it on, the panel:
- serves
*.<domain>on the same website - generates the wildcard DNS records for the name
- asks for a certificate that covers
<domain>and*.<domain>
An exact website always wins: a real site you later create on
shop.example.com serves that name, and the wildcard keeps the others.
The wildcard covers one label: shop.example.com is served,
a.b.example.com isn't, and the server answers it with status code 421.
If the domain's DNS zone isn't on this panel, create the wildcard DNS record at your DNS provider yourself. The panel also can't ask for a wildcard certificate for a zone it doesn't hold, so the subdomains show a certificate warning. The edit page says so when it applies.
HTTPS
The HTTPS setting says how strictly the site insists on HTTPS.
| Value | What visitors get |
|---|---|
| HTTP and HTTPS | Each visitor gets the address they asked for. Use this if part of the site must stay available over plain HTTP. |
| HTTPS only | A visitor who asks for http:// is sent to https://. The panel also publishes an HTTPS record in DNS, so a browser goes straight to https:// and the first plain-HTTP request never happens. |
| HTTPS only, with HSTS | The same, and the site asks each browser to remember it for 180 days. |
Every website is served over HTTP/1.1, HTTP/2, and HTTP/3, with nothing to set; a browser that supports HTTP/3 uses it.
A browser that has kept the HSTS answer refuses plain HTTP for this address, and won't let the visitor continue past a certificate warning, for the full 180 days, whatever you change here afterwards. Select this value once the site is finished and its certificate is correct.
Mail settings
The Mail service carries the mail policy for the whole domain:
| Setting | What it controls |
|---|---|
| Sender Verification | Your SPF, DKIM, and DMARC policies. The defaults are strict: DMARC refuses mail that fails. See Sender verification for what each means and when to relax them. |
| Spam Score Threshold | The domain default, 6.0 until you change it; a mailbox can override it. See Spam filter. |
| Sign-in and access policies | Password rules and default protocol access for the domain's users. Per-user overrides: Manage domain users. |
| Incoming and outgoing mail gateways | Route mail through an external filtering service or a smarthost. On the Mail Routing tab. |
| Relay to your own server | The panel accepts the domain's mail here and passes it to a mail server you run, for an individual mailbox, a relay-only address, or every mailbox on the domain. On the Mail Routing tab. See Relay to your own server. |
The Mail service divides these over four tabs: Sender Verification, Mail Routing, Authentication, and Account Policy. Mail Routing shows every hop a message takes before and after the panel accepts it, in one picture.
A gateway replaces the generated MX or SPF records with the provider's. An outgoing gateway can also carry SASL credentials and the provider's DKIM key, so authentication still passes.
Remove a service
A deleted service stops immediately. Two guards apply:
- You can't delete the zone service itself.
- You can't remove a Mail service while domain accounts still exist on the domain. Remove or move them first.
Deleting a Website leaves its files in your home directory. Only the serving stops.